Add super/jump admin, per-host connection tracking; move stats to Audit

- app_super_admin (cross-app, also recognized by sso-manager-node/proxy)
  and a new app_jump_admin group are added to conf.auth: super admins are
  full admins here same as app_sso_admin; jump admins get audit page/data
  access without other admin rights (isJumpAdmin/requireJumpAdmin in
  middleware/auth.js, wired into routes/api.js's audit-data gate and the
  /audit page's client-side forceLogin -- previously the page shell
  rendered for any logged-in user, only the data was gated).
- Dashboard: moved the stat boxes and Top hosts/Top users cards to the
  Audit page (audit is now the admin-facing metrics home; dashboard stays
  focused on "hosts I can reach"). Renamed "All hosts" to "My hosts".
- Host list now shows Last connection/Last failed connection columns and
  highlights rows green (live session, from session_registry) or yellow
  (most recent attempt failed) -- backed by new per-host last-success/
  last-fail timestamps in models/metrics.js, populated by ssh_server.js
  (which now attributes grammar/TUI connect failures to the resolved host
  when one was found, not just aggregate counters) and surfaced through
  GET /api/user/hosts (routes/user.js).

nodejs/middleware/auth.js

@@ -56,6 +56,25 @@ async function requireAdmin(req, res, next){
 	next(error);
 }
 
+// Jump admin = access to the audit page/data. A narrower grant than full
+// jump-host admin: full admins (isAdmin) always qualify, plus anyone in
+// conf.auth.jumpAdminGroups (e.g. a dedicated app_jump_admin LDAP group) can
+// be granted audit access without also getting other admin-only rights.
+function isJumpAdmin(req){
+	if(isAdmin(req)) return true;
+	const jumpAdminGroups = (conf.auth && conf.auth.jumpAdminGroups) || [];
+	return (req.groups || []).some(g => jumpAdminGroups.includes(g));
+}
+
+async function requireJumpAdmin(req, res, next){
+	if(isJumpAdmin(req)) return next();
+	const error = new Error('Forbidden');
+	error.name = 'Forbidden';
+	error.status = 403;
+	error.message = 'Jump admin access required.';
+	next(error);
+}
+
 // Socket.IO handshake auth (app-base.js connects with the session token).
 async function authIO(socket, next){
 	try{
@@ -69,4 +88,4 @@ async function authIO(socket, next){
 	}
 }
 
-module.exports = { auth, requireAdmin, authIO, isAdmin };
+module.exports = { auth, requireAdmin, authIO, isAdmin, isJumpAdmin, requireJumpAdmin };